# Plain Language Summary: Improving Cybersecurity of Small Businesses, Nonprofits, and Local Governments Act of 2021

This bill is designed to help small businesses, nonprofits, and local government agencies protect themselves from cyberattacks and data breaches. These organizations often lack the resources and expertise that large corporations have to defend against hackers and cybercriminals, making them vulnerable targets. The bill recognizes this gap and creates programs to give these smaller organizations the tools, training, and support they need to improve their digital security.

The legislation establishes federal initiatives to provide cybersecurity assistance and guidance tailored to the specific needs of small organizations. This includes helping them understand what security measures they should put in place, offering training programs for their staff, and connecting them with resources and experts who can advise them on protecting their systems and data. The bill also aims to make cybersecurity information and best practices more accessible and understandable for organizations that might not have dedicated IT security teams.

For small business owners, nonprofit leaders, and local officials, this means having better access to federal support and expertise to defend against cyber threats without having to hire expensive security consultants. It recognizes that cyberattacks can be devastating for smaller organizations—potentially shutting down operations, compromising sensitive information, or costing significant money to recover. By providing these organizations with better information, training, and resources, the bill aims to reduce the number of successful cyberattacks and help these groups operate more securely in an increasingly digital world.

Improving Cybersecurity of Small Businesses, Nonprofits, and Local Governments Act of 2021

Rosen, Jacky

Improving Cybersecurity of Small Organizations Act of 2021 This bill requires the Cybersecurity and Infrastructure Security Agency (CISA) to maintain and promote cybersecurity guidance for use by small organizations. Specifically, the bill requires CISA to maintain cybersecurity guidance that documents and promotes evidence-based cybersecurity policies and controls for use by small organizations to improve their cybersecurity. This guidance must be publicly available at no cost, and CISA, the Small Business Administration (SBA), and the Department of Commerce must promote the guidance through relevant resources that are regularly used by small organizations. Commerce must report on methods of incentivizing small organizations to improve their cybersecurity, including through the adoption of policies, controls, products, and services that have been demonstrated to reduce cybersecurity risk. Every two years, the SBA must submit and make publicly available specified data on the state of small businesses' cybersecurity.